I think it would make more sense to have the C++ default to false, remove the "true" from all.js, and enable it per-app. This way embeddors won't accidentally ship ping enabled without user-visible UI for it... Also, this way non-browser Gecko consumers won't be affected.

My recent patch to introduce nsIWebBrowserChrome2, also had the effect of disabling <a ping> by default in the code. I decided to leave the pref defined in all.js so that it would appear in about:config in products where it is not explicitly defined. Otherwise, this patch just moves the pref to firefox.js, so that it only affects firefox.